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KbK6).(b)(7)(C) I 

1 --Hn 


_ February 8, 1995. 
based on my machine, [ 


KbK6).(b)(7)(C) 

b t ___ 

e, |( b:: 6 . i fc: 17' i C 


was made aware that an individual 


military machines on the Internet. 

-1 -- — —-— - 


1 had illegally accessed 
The person who contacted me at home was 
] at Myriad Corporation, the ISP that leases our connectxvrty 
to the Internet. I immediately drove to Myriad 9nd cold that the 
law enfo rcement o fficer was going to neec to talk to me. On arrival I was 
taken to px^MbOTo | pffScg where he was cur rently talking to | 2n 

investigator from the Air Forcc. f^'| 1 


d be rsi 

It - 6 .. t * T :;C. 


ceivino an official letter in the mail and a 
J The field agent would not take any 


|(bX6),fb>(7; | 

x was told that I woul 
copy would be faxed to_ 

information from me at the time and did not want any passwords or 
information. The field agent, instructed me (if I was willing to 
cooperate and only then) to turn off the trimming of my log files in my 
crontab and not to change any configurations of the machine aside from 
that. Upon my request, the field agent gave me some general times that 


hacking activity was noted as occurring. A ssisted by[frywhx 7 ) | 

► ^ 1 0m 1 +■ 0*. f 4» «. s mm » m 


T issued 




pH6;.fb)(7xc; | 

[rhi's-killed crond and ensured 


then went home and logged in from home, 
amount of data that was not backed up on our system. 


E 


icr 

:b)(6).(b)fh(o 


would no longer occur. 


]and 


I had a significant 
We immediately 


(b)(6).(b)(7XCV 


and email. We left the system files, etc on the machine. 


went and bought a zip drive, drove to her office, ana downloaded backup 
copies of our all of our client webpages, home directories, 

j(b:;6;.ib;:(7)(cr 

Oncc I arrived at home, I started looking around to see if I could piece 
together exactly who r.he culprit was. My first step was to check our 
/var/iog/message file that logs system messages. I found no activity 
that I deemed as unusual during the alleged hacking tiroes. Next, I did 
a ’last' command to see who was logged in during those times. One user had been 
logged in at the appro ximate times of the hacking indicated by Field 
Investigator px6>.(bX7xc) | Below is a list of the last logs that we captured with the 

‘ * - * ■^KeJ.fb) 


we sus 

p(6Ub: 


|S£ 


ected. 


W) 


^indicates 


user 
user 

it was indeed her at that time onlv. 

C 

(bX<ht'bX7)(C) 



This account is sharec between pxft.mxncc) j *nd t 
ates that she was logged in on Feb 5, 16:25- 

jib:i6).(b/r7>(C) 


the 

16: 


overseas 
33 and that 
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8 

04:10 
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Sun 
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8 

00:49 
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00159 
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8 
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- 

04:01 

(04:03) 

Sun 
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8 

00:01 

- 

00:01 

(00:00) 

Sun 

Feb 

8 

00:00 

- 

00:01 

(00:00) 

Sat 

Feb 

7 

23:57 

- 

23:59 

(00:02) 

Sat 

Feb 

1 

23:55 

- 

23:56 

(00:01) 
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Fab 

6 

06:13 

- 

06:22 

(00:08) 

•Thu 

Feb 

5 

16:25 

- 

16:33 

(00:08) 

Wed 
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4 

02:56 

- 

02:57 

(00:01) 

wed 

Feb 

4 

02:35 

- 

02:53 

(00:18) 

Tue 
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3 

23:54 

- 

23:54 

(00:00) 

Toe 

Feb 

3 

05:49 

- 

06:08 

(00:19L 
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UbxTT 


Tue 
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3 

05:46 - 05:49 

(00:02) 


Tue 

Feb 


05:04 - 05:36 

(00:32) 


Tue 

Feb 

3 

04:50 - 04:57 

(00:06) 


Tue 
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3 

04:32 - 04:37 

(00:03) 

(b)(6),(bX7XC) 


KxkM) 

CC) 


t have highlighted a time range that seemed to match with what px 6 «b)(7)«b; |- 
indicat ed. Howe ver, T now see that I lumped the cun a bit in that the date was 
wrong. |(b)(6).(b)(7xcr"j jndicated a break in on Feb 5 00:40:02 EST and one Feb 4 10:00 
EST. According to this last log, I suopose that the bat account could not be 
suspect. The wtmp file was set to trim because I was more concerned with disk 
space than security so more data is not available. In my haste I accidentally 
lost the 'last' that contained all the users and their log in times. I t will be 
available on the tape restored system once the court order is obtained. p>^ b >^ c > [ 

_[ would like to have a note made though that I have seen the bat account logged 
in previously from two locations: foyeirbyfyc) I 


About this time. I was contacted by.another field investigator. 

(b)(6),(b)(7)(C) 


(b)(6).(b)(7)(C) 


arranged an appointment to meet me at my service providers 


of£ide~'where the machine resides. He also made arrangements to get backup 
copies of my drives. It was totally under my consent and he made it 
perfectly clear to me that I didn't have to backup the hard drives or 
cooperate with them at all. fcxeH bw j a x 5C gave mc some file names that 


the hacker had placed on previous systems co aid me in looking for 
information. The files he named were as follows: kbx*>.(b)tfx£) 



(bX6).(bX7}(C: 


"E Tter he called. I started poking around on my system some more. I edited no 
files, nor did I create any files in system areas. All thet I have included 
were taken from telnet session logs. I examined the ftp logs ana the message 
logs. I found nothing that I felt was important. Then I started looking for 
files on the system that had^been r ecently updated. I found some suspicious 
files namely a file nam ^ b:c:ib:7 ' :t [ in one c£ the /var directories. The contents, 
of ^**7 hinirr^ J ~r iM,,M T^ T was able to make out that the file 

'contained a list of al 


ill r.ha files in my root directory tree . px5),(b)(7XC) j 


(b)(6),(b)(7) 
(C) 


After this I went to sleep. I awoke the following morning and started 
working on getting information from my server. This was 2/9/98 around 08:00- 
logged in and checked /var/log/ roessages and fou nd many ICMP err ors for many 
different IP numbers. px6),(bX7XC) [ logged in on her |(b)(6).(bx7xc) ] account 

and did a lookup on the numbers. Many ware .af.mij sites. we 
immediately paged |j^,' 6 -' b:(7 | and left a message for p^ b ^~ C) .. ~j 

Here is a transcript from the log file that contained all the ICMP errors that 
we saw and the hosts they belonged to were inserted and are preceded by >. I 
know chat some of these are probably related to the apache httpa on my system. 
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However, I wanned to be thorough such that i f any of the 9 e sites coroe up on your 
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. 0 
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9 A:58:34 F 

^ 1 -__ 
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DSC 3^$!: 30:48 
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Jan 1 18:64:37 px^^xo 

(bX6}.(b)(7){C) 



Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failec. 

Source Route Farled. IFMmxTx^T 


Source Route Felled. 

Source Route Failed. 

Source Route Failed. 
Source Route Failed. 


fbX6) ! (bX7XC) 


Source Route Failed. 

Source Route Failed. 
Source Route Failed. 


Source Route Failed. 


b^.fb v7M', 
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Jan 'lpO) : 4 0 : 57 KbX6).(bX7XO 

- M 
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]Source Route Tailed. pwMWKc: 


Source Route Failed. KbX6),(bX7xc) 


] Source Rcute Failed. 
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- •** Jan 
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Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 


b)(6}.(bxtx£? 


^ourca Route Failed. 


Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 


Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 


Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 
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3 09:07:09 
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-S 

Jan 
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Jan 

4 03:01:00 
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Source Route Failed. 
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Ibxfc).(bx7xc) 


Jan 

Jan 
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8 05:44:40 
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8 05:58:49 


(bX6).(bX7XC) 
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0 

Jan 

□ 

Jan 

Jan 

Jan 

Jan 

Jan 

Jan 

Jan 

Jan 

(bX6).(b)(7j(C) 


-71- 

8 21:05:46 

8 21:06:06 

6 21:06:30 
S 21:08:54 
8 21:14:54 
8 21:18:54 
8 21:20:54 
8 21:24:54 
8 21:26:54 
8 21:28:54 


(bX6),(bX7XC) 


Jan 9 05:36:15 
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Jan 6 07:08:06 
Jan 6 07^08:37 
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TSTSurce Route Failed. 

Source Route failed. KbkeubxW) 



Source Route Failed. 

Source Route failed. 

Source Route Failed.p> (6 >< b x 7)(C > 


'Srtrrce Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 


(b)(6).(b n7}<C} 


Source Rout? Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route railed. 

Source Route Failed._ 

Source Route Failed .P K6)(b!(7KC> 


(bX6).(bX7XC) 

Source Route Failed. 


(bX6).(bX7XC) 
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a 

9 >0:00:56 
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IS 
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Source Route Failed. 
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Source Route Failed. KbX6).(bX7xc> 
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Source Route 
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Jan 

9 

23:17:42 

(bX6),(bX7XcF" 
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Jan 

9 

23:20:51 


Jan 

9 

23:22:51 


Jan 

9 

23:24:51 


Jan 

9 

23:26:51 


Jan 

9 

23:28:51 


Jan 

9 

23:30:51 


Jan 

0 

23:32:51 


Jan 

9 

23:34:51 


Jan 

9 

23:36:51 


Jan 

9 

23:38:51 


Jan 

9/23:40:51 


CbX6),(bX7XC) 




-- 


Jan 

10 

00:27:26 
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10 

00:28:07 


11 

v/ 




Source Route railed. 


source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 


Route 

Route 

Route 

Route 

Route 

Rcxrte 

Route 

Route 

Route 

Route 

Route 


Failed. 
Failed. 
Failed. 
Failed. 
Failed. 
Failed, 
failed. 
Failed, 
fai\ec. 
failed. 
Failed. 


fb;(6).(b)(7)(C) 


Source Route Failed. 


Source Route railed. *"■**'*» 



Source Route Failed. 


Source Route Failed. 

Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failad. 


(b>(6).(bX7;(C) 


Source Route Failed. 


Source Route Failed. rFTTtTT 

CC) 


Jan U 15:49:55 F 5 * 5 ® 57 ® 

(b)(6>.( b)(7)(C) 


Source Route Failed. 
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Jan 11 19:49:58 

Jan 11 19:51:23 

Jan 11 19:51:04 
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Jan 11 20:07:04 

Jan 11. 20:09:04 
«■ ' 




Source Routs Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed.K'xfiMbxfxi: 


Jan 13 00:58:23 

. 1 

(bX6),(bx71xC) 

Source Routs Failed. 



Jan 13 00:58:29 
Ja/j 13 01:17:12 

(b)(6).(b)(7XC) 


Source Route Failed. 
Source Route Failed. 

Lstenc host/comain 

(bX6).(bX7XC) 

Non-ex: 


Jan 14 06:37:12 
Jan 14 06:37:19 

(bX6>Yb)(7XC; V ^ ^ 


(b)(6),(b)(7>(C: 


(bX6).(bX7)(C) 


Jan 14 21:47:34 

i* * 

.1_-i__ 


(b)(6).(b)f7:(C) 


(b)(6).(bX7)(C) 


.-Tan 15 16:28:45 


(b)(6),(b)(7XC) 


r 


H\ 

Jan 15 22:55:06 

■J \ 

|(b)(6).(bX7XC)- 


Jan 

16 

-n\ - 

05:33:33 

C 



Jan 

16 

05:34:24 

II 



Jan 

16 

05:35:12 

u 

Jan 

16 

05:36:43 

Jan 

16 

OS; 33 : 43 

Jan 

16 

05:40:48 

Jan 

16 

05:42:48 

Jan 

16 

05:46:48 

Jan 

16 

05:48:43 

Jan 

16 

05:50:43 

Jan 

16 

05:52:48 



Sour ce Route Failed. 
‘SWPFfca- Route Failed. 


tmimrr 


Source Route Fai .imubmc 


Source Route Failed. 


(bX6),(bX7XC) 

Source Route Failed. 

(bX6),(bX7XC) 






Source Route Failed. 
Source Routs Failed. 
Source Route Failed. 


Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 


Route Failed. 

Route Failed. 

Route Failed. 

Route Failed. 

Route Failed. 

Route Failed. 

Route Failed. 

Route Failed. 1*^6:. t.Jxc 
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BEST AVAILABLE COPY 


r. iO' xo 


(b)(6).(b)(7)(C; 


Jan 16 05:54:48 px^xcbxTx^T 
Jan 16 05:56:48 


|(b)(6).(bK7KC) 


mrnvr 


Jan 16 14:55:15 
: i 

Jan 16 15:01:15 


(b)(6).(b}(7XC) 


n 


-*L- 


n 

EE WubxM) 


(b)(6),fb;(7XC} 


. -• - Jan 

.1 

Jan 

C 

Jan 
Jan 
Jan 
Jan 
Jan 
Jan 
Jan 
Jan 
Jan 
Jan 
Jan 
Jan ^7^2 

(bK6),(b)(7)(C) 


U.U9:27: 

17 21:03: 

17 21:05: 
17 21:06: 
17 21:0$: 
17 21:10: 
17 21.: 12: 
17 21:14: 
17 21:16: 
17 21:13: 
17 21:20: 
17 21:22: 
17 21:24: 
|7 21:26: 


59 

35 

08 

44 

44 

44 

44 

44 

*4 

At 

44 

44 
4 A 
44 


(b)(6), (bX7)(C) 


(b)(6) (b)(7)(C) 


- r - 

Jan 17 23:41:58 


Q 

FBTOTOT 


[b)(6).(bX7)(C> 


Source Routs failed. 
Source Route failed. 


=e 


Jan 18 11:09:12 

□ 

Jan 18 11:12:21 
U . 

Jan 19 11:16:21 

c; 

Jan 18 11:18:21 
Jar. 13 11:20:21 



^Non-existent host/domain p^-waxc" 
Source Route failed. 

Source Route Failed, j^eub " ^ 1 ? ' 


Jan 15 19:32:371 

) , 1 
_V/^_ 

|(bxWbkV)((^ . ‘ '““j 



(bX6),(bX7XC) 

• 





Source Route Failed, fmmcnic- 


Source Route Failed. 


iNon^existent host/domain 


Source Route Failed. 


Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 


Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 


Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed.pmETOCr 

Failed. 


Source Route Failed. P K6) - (b)(7KC) 



Non-existent host/domain 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 
Source Route Failed. 
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rco-1^-1330 ^5*00 


r.11/10 


BEST AVAILABLE COPY 


j(b>(6).(b)i7'; 


Jan 19 11:22:21 
Jan 13 11:24:21 
Jan 1$, 11:32:21 

(bK6:.(bK7KC.' 


(b)(6).(bX7XC) 


Jan 19 02:13:46 



(b)(6),(bX7)(C) 


r~ 

Jan 20 17: 
Jan 20 17; 
Jan 20 17i 
Jan 20 17; 
Jan 20 17; 
Jan 20 17: 
Jan 20 17; 
Jan 20 17; 
Jan 20 17 j 
Jan 20 17; 
Jan 20 17: 

(b)(6), (b>(7)(6;: 


04:28 
05:13 
06:01 
09:37 
11:37 
13:37 
15:37 
17:37 
19:37 
25:37 
27:37 


(b)(6}.(b}(7XC) 


Jan 21 21:56:07 
, I 




Jan 23 09:54:15 

n 

Jan 23 09:54:40 


Source Route Fail p.o. 

Source Route Failed. 

Source Route Failed. ib)(6).(bx7xc) 



Source Route Failed. 

Source Route Failed. 

Source Route Failed. bx6),(bX7>(C) 


Jan 19 05:36:01 |" )X6) - (,)X7XC) 

Source Route Failed. 


(bX6),(bX7XC) 






Non-existent host/domain 



fragmentation needed and OF 


Source 

•Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 


Route Failed. 
Route Failed, 
Route Failed. 
Route Failed. 
Route Failed. 
Route Failed. 
Route Failed. 
Route Failed. 
Route Failed. 
Route Failed. 
Route Failed. 


mrmw 


Non-existent host/domain 


Jen 22 22:40:51 
0 

Jan 22 22:41:59 

(bX6),(bX7XC) 

(bXb),(bX7XC) 



Source Route Failed. 

Source Route Failed. lOTHETOTT 



Source Route Failed. 

Source Route Failed. pxe).rbx7xc> 


(bX6).(b)(7)(C> 


(J 

& 




1 















































































FEB-12-1998 


09: 


r. ic'' xo 


BEST AVAILABLE COPY 


(DX6).(bK7XC; 



Jan 

23 

14:29:46 


Source 

Route 

failed. 

.1 

Jan 

\ • 

23 

14:32:S7 


Source 

Route 

Failed. 

Jan 

23 

14:36:57 


Source 

Route 

Failed. 

Jan 

23 

14:36:57 


Source 

Route 

failed. 

Jan 

23 

14:40:51 


Source 

Route 

Failed. 

Jan 

23 

14:42:57 


Source 

Route 

Failed. 

Jan 

23 

14:44:57 


Source 

Route 

failed. 

Jan 

23 

14:46:57 


Source 

Route 

failed. 

Jan 

23 

14:46:57 


Source 

Route 

Failed. 

Jan 

23 

14:50:57 


Source 

Route 

Failed. 

Jan 

iF!(6:.(bx7Wft) 

m 

14:52:57 


Source 

Route 

railed. 


Jan 

24 

00:58:22 

(Ex6UbX7x6>- - - 

! / 

Jen 

24 

01:00:40 


Jan 

24 

01:01:31 


Jan 

24 

01:03:30 


Jan 

24 

01:06:16 


Jah -2*101:07:31 


Jan 

24 

01:09:31 


Jan 

24 

01:10:15 


Jan 

24 

01:11:31 


Jan 

24 

01:13:30 


Jan 

24 

01:15:30 


Jan 

24 

01:13:16 


Jan 

24 

01:20:15 


Jen 

24 

01:20:16 


Jan 

24 

01:34:54 


Jen 

24 

01:37:54 


Jen 

24 

01:39:08 


Jan 

24 

01:41:54 


Jan 

24 

01:43:08 


Jan 

24 

01:45:08 


Jan 

24 

01:45:54 


Jan 

24 

01:47:08 


Jan 

24 

01:49:09 


Jan 

24 

01:49:54 


Jan 

24 

01:51:08 


Jen 

24 

01:51:54 


Jan 

24 

01:53:08 


Jan 

24 

01:53:54 


Jan 

24 

01:55:54 


Jan 

(bX6),(bX7XC) 

11 

0^:57:51 






Jan 24 v4 :16:3* 

U 

Jan 24 04:18:07 

I.S 

(b)(4),(bk?k£) 



Source Route Failed. 


Source Route failed. 
Source Route failed. 
Source Route failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed, 
Source Route Failed. 
Source Route Failed. 
Source Route failed. 
Source Route Failed. 


Source Route failed. 
Source Route failed. 
Source Route Failed. 
Souroe Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route failed. 
Source Route failed. 
Source Route Failed. 
Source Route failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route Failed. 
Source Route failed. 


(bK6).(b)(7)(C> 


Source Route Failed. 
Source Route Fax led. 


(bxeubxTxcT 


(b)(6).(b>{7>(C: 

/J 

* 1 ztr 
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H.13/16 


BEST AVAILABLE COPY 


ib)(&MbX7HC: 


Jan 24 


Jan 24 
Jan 24 
Jan 24 
Jan 24 
Jan 24 
Jan 24 
Jan 24 
Jan 24 
Jan 24 
Jan 24 

(bM6).<bX7)(C) 


04:19:43 

04:21:43 

04:23:43 

04:25:43 

04:27:43 

04:29:43 

04:31:43 

04:33:43 

04:35:0 

04:37:43 

04:39:43 



Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. Kbx6i.(bx7xc) 


Jan 25 13:31:57 pxewwxc: 


Jan 25 13:36:32 

(b)(6).(b){7}(C} 


Non-existent host/domain 
Source Route Failed. 


Source Route Failed. 


(b)(6).i b)(7)(C': 



Jan 25 22:56:33 

(b)(6), (b>(7)(6 


X6).(b)(7)(C) 


Non-existent host/domair. 

Source Route Failed. 


Non-existent host/domain 


• f 

(b^k(t>X7)(C) 



Jan 26 00:00:53 


Source Route Failed. 

(bX6),(bX7XC) 

*• 




(bX6).(bX7XC) 





Jan 26 20:46:45 

(bX6),(bX7XC) 

Source Route Failed. 

Jan 26 20:49:54 
1— 


Source Route Failed. 

W 

Jan 26 20:51:54 


Source Route Failed. 

J*n 26 20:53:54 


Source Route Failed. 

Jan 26 20:55:54 


Source Route Failed. 

Jan 26 20:57:54 


Source Route Failed. 

Jar. 26 21:03:54 


Source Route Failed. 

Jan 26 21:07:S4 


Sourea Route Failed. 

Jar 26 21:09:54 


Source Route Failed. 

(b)(6).(bX7XC) 

EbX8MbX7X6) 

"jserver zaileci-r 



Jan 26 22:12:47 

(b)(6),(bX7XC) 

Source 

0 

Jan 26 22:14:19 


Source 

o 

Jan 26 22:14:<*0 


Source 

a 

Jan 26 22:21:06 


Source 

(bX6).(bX7XC) 




(bX6}.(b}(7)(C) 


(b)(6).(b)(7)(C) 


/3 
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r-tlD-1 <£-1 WO OV • 0*4 


BEST AVAIL4BLE COPY 


Jan 27 


ds:23: 


20 


Jan 27 05:25:03 

__M ^ _ 

(b)(6).(b)(7XC) 


bX6).(b)(7)(C) 


(b)(6).(b)(7XC) 


Jan 27 05:48:20 

It 

Jan 27 05:48:32 
Jan 2) 05:45:59 


CbX6) (b)(7)(C) 


(b)(6).(b)(7)(C 


- 'TT - 

Jan 28^1:35:47 




Jan 31 03:20:50 fM6).(bX7xc) 
LI 

(bX6).(bX7)rc) 


Feb 
feb 
Feb 
Fab 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
(b)(6),(bX7XC) 


14 : 
14: 
14s 
14: 
14: 
14: 
14: 
14: 
14: 
14; 
14: 
14: 
14 s 




26:39 

26:42 

23:12 

29:46 

31:48 

33:48 

35:48 

37:48 

39:48 

41:48 

43:4S 

45:48 

47:48 

49:48 


(b)(6).(b)(7>(C) 


Peb 3 13’:'08:16 


r. 1*4/10 


CbX6),(bX7XC) 

Jan 21 00:42:54 

(b)(6),(bX7XC) " 


(bX6),(bX7XCr" " 



Source Route Failed. 


Source Route Failed. 
Source Route Failed. 


ib>(6).(b)(7XC) 


Jan 27 03:26:57 

(OTOTTO- 


Source Route Failed. 


Jan 27 05:26:59 



Source Route Failed. 

(bX6),(b)(7XC) 


mmm - 








Non-oxistent host/domain 



Source Route Failed. 

Source Route Failed. 
Source Route Failed. 


(b)(6).(b)(7)(C) 


protocol unreachablepmtbxVxc 


Source Route Failed. 


Non-existent host/domain 


Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 

Source 


Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 


Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 

Failed. 


(b)(6).(b)(7)(C) 


ikmuwi - 

Source Route Failed. 

mmm — 





|(bX6),(bX7)(C) 




<*- 1 ^ 


M 














































































15 


















































































r. j.o 


BEST AVAILABLE COPY 


(b)(6).(b;(7> 
(C) 


Feb 

5 

17:38:48 

Feb 

5 

17:40:33 

Feb 

5 

17:40:48 


(b)(6).(b)(7XC) 


(bX6).(bX7}(C) 


Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 
Feb 

(b)(6}.(b)(7)(C} 


03:13:51 
03:20:30 
03:21:46 
03:25:46 
04:28:25 
04:32:51 
04:37:53 
6 04:43:06 
6 05:15:18 
.6 05:25:45 


m'MW) 


Feb 

(b)(6).(b)(7)(C) 


7 14:17:00 

»J 


Kb)(6).ib)(7'{C: 


Feb 

□ 

Feb 

Feb 

Feb 

Feb 

Feb 

Feb 

Feb 

Feb 

(b)(6).(bX7;(C: 


7 15:17:31 


(bkfe}.(bX7)(C) 


15:19:04 

15:20:40 

15:22:40 

15:24:40 

15:26:40 

15:28:40 

15:30:40 

15:32:40 


Source Route railed. 

Source Route Failed. 

Source Route Failed . Kb)(6).(b)(7xc) 


Source 

Source 

Source 

Source 

Source 

Scarce 

Source 

Source 

Source 

Source 


Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 

Route 


Failed. 
Failed. 
Failed. 
Faileo. 
Failed. 
Failed. 
Failed. 
Failed. 
Failed. 
Failed. 


imwm 


Source Route Failed. ibX6).ibX7KC) 




Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. 

Source Route Failed. | fo({i.( b \(7),i) | 
Source Route Failed 


Non-existent host/domain 


(bX6).(bX7XC$ 


Feb 7 13:46:40[ 


b)(6).ib)(7)(C) 


> 


ource Route Failed. 


(b)(6}.(bX7>(C) 


Feb Tf 20:12:40 

(bx6)(bX7XC^ 


Source Route Failed. 

(bX6).(bX7XC) 

(bX6),(bX7XC) 




8^5:53:34 (bK6)(bK7KC 


Source Route Failed. Kb>(6).(bX7xc) 


(bX6).{bX7XC) 


Feb 9 ob'27:5l| 

pm(bX7xci - 1 


Source Route Failed 


(bX6).(b)(7)(C) 



|b)(6).(bX7)(C) 


] 
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TOTAL P.16 
























































































